fixing security issue with YAML